Behavioral task
behavioral1
Sample
ff6f04b1989c57b3c7b7193eaaa9a04f_JaffaCakes118.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
ff6f04b1989c57b3c7b7193eaaa9a04f_JaffaCakes118.exe
Resource
win10v2004-20240802-en
General
-
Target
ff6f04b1989c57b3c7b7193eaaa9a04f_JaffaCakes118
-
Size
77KB
-
MD5
ff6f04b1989c57b3c7b7193eaaa9a04f
-
SHA1
c03c6e2903d3b133238c5a819caf813de893d186
-
SHA256
f0f3a302026191f8ee137573b2bf7428537b5d8fce7d740f6d702b4d6d9aa3a7
-
SHA512
6bfd7f36de30d8b2c5cd6eaebf1e74cd1a84b68ecb951db75d4a77e71edc12b0e489394db59a876c3709b5c7d3d5ff193d3d11d1988b25dd5aec07f1f58a350f
-
SSDEEP
768:I+TqO1szdgwx7CHaHDoWTfYWqNNUbQ3GJhSYI2BNUU:jTqO1sZfCSo7WQ3Cc2B
Malware Config
Signatures
-
resource yara_rule sample upx -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ff6f04b1989c57b3c7b7193eaaa9a04f_JaffaCakes118
Files
-
ff6f04b1989c57b3c7b7193eaaa9a04f_JaffaCakes118.exe windows:4 windows x86 arch:x86
631c379ca5a08c890478b8db01125ef2
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Imports
kernel32
WriteFile
VirtualQuery
SetFilePointer
ReadFile
GetVersionExA
GetThreadLocale
GetStringTypeExA
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetDiskFreeSpaceA
GetCPInfo
GetACP
ExpandEnvironmentStringsA
EnumCalendarInfoA
CreateFileA
CloseHandle
TlsSetValue
TlsGetValue
LocalAlloc
GetModuleHandleA
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSection
VirtualFree
VirtualAlloc
LocalFree
LocalAlloc
GetCurrentThreadId
WideCharToMultiByte
SetCurrentDirectoryA
lstrlenA
lstrcpynA
LoadLibraryExA
GetThreadLocale
GetStartupInfoA
GetProcAddress
GetModuleHandleA
GetModuleFileNameA
GetLocaleInfoA
GetLastError
GetCommandLineA
FreeLibrary
FindFirstFileA
FindClose
ExitProcess
WriteFile
UnhandledExceptionFilter
RtlUnwind
RaiseException
GetStdHandle
advapi32
RegQueryValueExA
RegOpenKeyExA
RegCloseKey
oleaut32
SysFreeString
shell32
ShellExecuteA
user32
MessageBoxA
LoadStringA
GetSystemMetrics
CharNextA
GetKeyboardType
LoadStringA
MessageBoxA
CharNextA
Sections
UPX0 Size: 72KB - Virtual size: 72KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.avp Size: 2KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE